fix: validate access before publishing library bump branches

RELEASE.md

@@ -41,6 +41,8 @@ scripts/create-library-version-bump-pr.sh
 
 The script reads the official package sources for .NET, Java, JavaScript, Python, Python coverage, Ruby, and Go/Orchestrion. If at least one pinned default is outdated, it creates a branch, updates `action.yml` and `README.md`, creates and verifies a signed commit, pushes the branch, and opens a PR.
 
+Before making changes, it checks that the credentials selected by `gh` have write access to this repository. Git SSH authentication and `gh` API authentication can use different accounts. It reuses existing labels and creates any missing labels before creating the branch, so a label permission failure stops before any commit or push.
+
 The PR receives:
 
 - `library-version-bump`

scripts/create-library-version-bump-pr.sh

@@ -39,15 +39,20 @@ for command in curl gh git ruby; do
   fi
 done
 
-gh api user --silent >/dev/null
-
 base_branch="main"
 bump_label="library-version-bump"
 remote="origin"
 repo="DataDog/test-visibility-github-action"
 semver_minor_label="semver-minor"
 semver_patch_label="semver-patch"
 
+if [[ "$dry_run" != "true" ]]; then
+  if ! can_push=$(gh api "repos/$repo" --jq '.permissions.push // false') || [[ "$can_push" != "true" ]]; then
+    echo "The current gh account cannot access $repo with write permissions. Check gh auth status and select an account with repository access." >&2
+    exit 1
+  fi
+fi
+
 read_default() {
   ruby -ryaml -e 'puts YAML.load_file("action.yml").fetch("inputs").fetch(ARGV.fetch(0)).fetch("default")' "$1"
 }
@@ -201,6 +206,29 @@ if git show-ref --verify --quiet "refs/heads/$branch_name"; then
   exit 1
 fi
 
+existing_labels=$(gh api --paginate "repos/$repo/labels" --jq '.[].name')
+
+ensure_label() {
+  local label="$1"
+  local description="$2"
+  local color="$3"
+  local existing_label
+
+  while IFS= read -r existing_label; do
+    if [[ "$existing_label" == "$label" ]]; then
+      return 0
+    fi
+  done <<< "$existing_labels"
+
+  if ! gh label create "$label" --repo "$repo" --description "$description" --color "$color"; then
+    echo "Could not create required label '$label'. Check the gh account's label permissions. No branch, commit, or push was created." >&2
+    return 1
+  fi
+}
+
+ensure_label "$bump_label" "Marks PRs that bump pinned library versions" "1D76DB"
+ensure_label "$release_label" "Requests a $release_bump_kind test-visibility-github-action release after merge" "0E8A16"
+
 git fetch "$remote" "$base_branch"
 git checkout -b "$branch_name" FETCH_HEAD
 
@@ -211,18 +239,6 @@ git commit -S -m "chore: bump pinned library versions"
 git verify-commit HEAD
 git push -u "$remote" "$branch_name"
 
-gh label create "$bump_label" \
-  --repo "$repo" \
-  --description "Marks PRs that bump pinned library versions" \
-  --color "1D76DB" \
-  --force
-
-gh label create "$release_label" \
-  --repo "$repo" \
-  --description "Requests a $release_bump_kind test-visibility-github-action release after merge" \
-  --color "0E8A16" \
-  --force
-
 changes_markdown=$(printf -- '- %s\n' "${changes[@]}")
 body_file=$(mktemp)
 trap 'rm -f "$body_file"' EXIT